diff options
| author | Paul Buetow <paul@buetow.org> | 2026-06-30 18:08:23 +0300 |
|---|---|---|
| committer | Paul Buetow <paul@buetow.org> | 2026-06-30 18:08:23 +0300 |
| commit | f03e1609ff438e6455bcd64de14dd4a447e8e6e5 (patch) | |
| tree | ec7cb71a67c11f9304a3e8075407fc68ba2157f0 /yhttpd/src/cli/cli.cpp | |
| parent | 6d079fb6c623e0897c6fc098c8d684565faa7af7 (diff) | |
Reclaim oversized-request fds (inline delete) + fix context ctor UAF
Root cause of the earlier 2s0 oversized-delete crashes: the context
constructor initialized p_user=NULL but NOT p_map_params or p_response,
so ~context's 'if (p_map_params) delete p_map_params' / 'if (p_response)
delete p_response' ran on garbage (non-NULL) pointers on the early-delete
paths (EOF-empty, hard read error, oversized) -> a corrupted
std::map<string,string> destructor -> infinite _M_erase recursion ->
SIGSEGV. It was never a libevent issue.
Fix:
- src/sock/context.cpp: initialize p_map_params = NULL and p_response =
NULL in the constructor (p_user was already NULL). ~context null-guards
them, so all early-delete paths are now safe.
- src/sock/sock.cpp: the oversized-request branches (headers-incomplete-
full and body-incomplete-full) now drop the request inline via
del_event()+delete (exactly like the EOF/hard-error sibling branches)
instead of leaking the fd/context. This closes the 2s0 fd-exhaustion
DoS (the deliberate leak tradeoff) with no crash.
Verified: 30 oversized POSTs -> open fd count stays at baseline (7->7,
immediate reclaim, no leak), 0 restarts; normal login + multi-user chat
work. Independent review: APPROVE (preferred the simplification to
inline-delete, applied).
Diffstat (limited to 'yhttpd/src/cli/cli.cpp')
0 files changed, 0 insertions, 0 deletions
